Site Mobile Navigation

Europe Says Search Firms Are Violating Data Rules

BERLIN — European Union officials on Wednesday said Google, Microsoft and Yahoo had violated rules by keeping data on individual computer users for too long.

A group of 27 European national privacy chiefs said it would also ask the United States Federal Trade Commission to investigate whether the data retention practices of the three companies violated American law.

In a letter sent Wednesday, the advisory panel to the European Commission asked the three companies to appoint outside auditors to verify that their practices of rendering individual data anonymous truly eliminated all links to individuals.

Under European Union data protection rules, search engines are required to sever all traceable links to individual computer users completely and irrevocably after six months.

European data protection officials have been urging the search engines since 2007 to shorten the time they retain information on computer users. In response, the engines have cut retention periods from 18 months, but the moves are still not enough to satisfy the regulators.

Of the three companies, Microsoft, which operates the Bing search engine, has said it would comply with the commission’s request to render data from individuals anonymous after six months, but it still plans to retain software cookies and other session identifiers for 18 months.

Google retains data for nine months, and Yahoo has said it will remove part of a computer’s unique identification number, the Internet protocol address, after 90 days but reserved the right to recreate individual logs at the request of law enforcement authorities.

In its letter to the three companies, the panel of privacy chiefs, called the Article 29 Working Party, said all three methods were insufficient and violated European Union data protection rules.

The data in question includes all types of information that a computer user enters into a search engine field, which is then collected to build a personal profile of preferences that can help search engines direct ads more narrowly to individuals.

Search engines say they need to keep the data longer to make the search process more efficient and relevant.

In its letter, the European group singled out Google, the global search leader, which has about 80 percent of the European search market, according to comScore, a research firm.

“Considering Google’s dominant position in almost every E.U. member state, with a market share of up to 95 percent in some national search engine markets, the company has a significant role in European citizens’ daily lives,” the European panel wrote. “The company’s apparent lack of focus in data retention is concerning.”

A Google spokesman, Al Verney, said the company had not yet received the letter from the panel, but he said that the group apparently had asked questions of all major search engines, not just Google.

“Google was the first search engine to reduce the time it stores search logs,” and the first to make them anonymous, Mr. Verney said.

“We develop our policies,” he added, “based on what provides the best experience for users both in terms of respect for their privacy and the quality and security of our services. Our current retention policy represents the most responsible balance between these two important concerns.”

In a related privacy issue, Google balked at a German government regulator’s request to surrender Internet data it had improperly collected from unsecured wireless networks there, saying the company needed more time to resolve legal issues.

“As granting access to payload data creates legal challenges in Germany which we need to review, we are continuing to discuss the appropriate legal and logistical process for making the data available,” said Peter Barron, a Google spokesman in London. “We hope, given more time, to be able to resolve this difficult issue.”

The data protection supervisor in Hamburg, Johannes Caspar, had given Google until midnight Wednesday in Germany to surrender the data or risk unspecified sanctions. Mr. Caspar was not immediately available for comment.

A version of this article appears in print on May 27, 2010, on page B6 of the New York edition with the headline: Europe Says Search Firms Are Violating Data Rules. Order Reprints|Today's Paper|Subscribe